.github/workflows/skill-coverage.yml:27

• The startsWith(github.event.comment.body, '/skill-coverage') predicate matches /skill-coverageX (and the bash parsing will accept it). If you intend to only accept /skill-coverage followed by whitespace or end-of-line, tighten the check (e.g., regex match) to avoid accidental triggers.

    if: >-
      github.event_name == 'pull_request' ||
      (github.event_name == 'issue_comment' &&
       github.event.issue.pull_request &&
       startsWith(github.event.comment.body, '/skill-coverage'))
    runs-on: ubuntu-latest

.github/workflows/skill-coverage.yml:179

• $anyFailed is initialized but never used, which makes the step harder to maintain and suggests error handling may be incomplete. Either remove it or use it to control the step’s final exit code if you want the workflow to fail when any target can’t be analyzed.

          $targets = $env:TARGETS_JSON | ConvertFrom-Json
          $allJson = @()
          $anyFailed = $false
          $summary = @()

.github/workflows/skill-coverage.yml:18

• The workflow uses the Issues API (reactions.createForIssueComment, issues.createComment, issues.updateComment, issues.listComments), but the job permissions only grant pull-requests: write. This commonly fails with 403 because PR comments are issue comments under the hood; add issues: write (and reactions: write if you want to scope narrowly) to the workflow/job permissions.

permissions:
  contents: read
  pull-requests: write

.github/workflows/skill-coverage.yml:90

• For issue_comment triggers this checkout uses ref: <branch-name> in the base repository. That won’t work for fork PRs (the branch lives in the fork), so /skill-coverage will fail to check out the PR head. Use the PR head SHA with the refs/pull/<num>/head fetch pattern (as in evaluation.yml), or set repository: to the PR head repo when checking out.

      - name: Get PR ref for comment trigger
        id: pr-ref
        if: github.event_name == 'issue_comment'
        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
        with:
          script: |
            const pr = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number
            });
            core.setOutput('ref', pr.data.head.ref);
            core.setOutput('sha', pr.data.head.sha);
            core.setOutput('base_sha', pr.data.base.sha);
            core.setOutput('pr_number', context.issue.number);

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event_name == 'issue_comment' && steps.pr-ref.outputs.ref || '' }}
          fetch-depth: 0
          persist-credentials: false

.github/workflows/skill-coverage.yml:193

• Measure-SkillCoverage.ps1 -Format Json emits pretty-printed multi-line JSON (ConvertTo-Json without -Compress). Capturing the script output into $result and piping $result | ConvertFrom-Json will treat each line as a separate pipeline input and typically fails to parse. Join the output into a single string (e.g., Out-String) before ConvertFrom-Json, or update the script/workflow so JSON output is compressed/single-line.

            try {
              $result = & "$env:GITHUB_WORKSPACE/eng/skill-coverage/Measure-SkillCoverage.ps1" @args
              $parsed = $result | ConvertFrom-Json

              # Handle single or array results
              $reports = if ($parsed -is [array]) { $parsed } else { @($parsed) }